netfilter: x_tables: add LED trigger target

[pandora-kernel.git] / net / netfilter / Kconfig

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 25dcef9..cdbaaff 100644 (file)
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -357,6 +357,45 @@ config NETFILTER_XT_TARGET_DSCP
 
          To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_TARGET_HL
+       tristate '"HL" hoplimit target support'
+       depends on IP_NF_MANGLE || IP6_NF_MANGLE
+       depends on NETFILTER_ADVANCED
+       ---help---
+       This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
+       targets, which enable the user to change the
+       hoplimit/time-to-live value of the IP header.
+
+       While it is safe to decrement the hoplimit/TTL value, the
+       modules also allow to increment and set the hoplimit value of
+       the header to arbitrary values. This is EXTREMELY DANGEROUS
+       since you can easily create immortal packets that loop
+       forever on the network.
+
+config NETFILTER_XT_TARGET_LED
+       tristate '"LED" target support'
+       depends on LEDS_CLASS
+       depends on NETFILTER_ADVANCED
+       help
+         This option adds a `LED' target, which allows you to blink LEDs in
+         response to particular packets passing through your machine.
+
+         This can be used to turn a spare LED into a network activity LED,
+         which only flashes in response to FTP transfers, for example.  Or
+         you could have an LED which lights up for a minute or two every time
+         somebody connects to your machine via SSH.
+
+         You will need support for the "led" class to make this work.
+
+         To create an LED trigger for incoming SSH traffic:
+           iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
+
+         Then attach the new trigger to an LED on your system:
+           echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
+
+         For more information on the LEDs available on your system, see
+         Documentation/leds-class.txt
+
 config NETFILTER_XT_TARGET_MARK
        tristate '"MARK" target support'
        default m if NETFILTER_ADVANCED=n
@@ -373,11 +412,10 @@ config NETFILTER_XT_TARGET_MARK
 config NETFILTER_XT_TARGET_NFLOG
        tristate '"NFLOG" target support'
        default m if NETFILTER_ADVANCED=n
+       select NETFILTER_NETLINK_LOG
        help
          This option enables the NFLOG target, which allows to LOG
-         messages through the netfilter logging API, which can use
-         either the old LOG target, the old ULOG target or nfnetlink_log
-         as backend.
+         messages through nfnetlink_log.
 
          To compile it as a module, choose M here.  If unsure, say N.
 
@@ -606,6 +644,14 @@ config NETFILTER_XT_MATCH_HELPER
 
          To compile it as a module, choose M here.  If unsure, say Y.
 
+config NETFILTER_XT_MATCH_HL
+       tristate '"hl" hoplimit/TTL match support'
+       depends on NETFILTER_ADVANCED
+       ---help---
+       HL matching allows you to match packets based on the hoplimit
+       in the IPv6 header, or the time-to-live field in the IPv4
+       header of the packet.
+
 config NETFILTER_XT_MATCH_IPRANGE
        tristate '"iprange" address range match support'
        depends on NETFILTER_ADVANCED